CVE-2026-6647High· 7.4▾ TwilightIn deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation op…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username case handling can occur. This inconsistency results in OAuth token revocation operations failing to correctly identify usernames containing mixed-case characters during certain lifecycle events, preventing tokens from being invalidated.
A malicious actor can exploit this vulnerability by possessing a valid access or refresh token associated with a mixed-case username. In affected configurations, these tokens may not be revoked when expected. The actor can then leverage these unrevoked tokens, before their expiry, to continue performing actions that should have been restricted, effectively bypassing intended access controls.
identity_server >= 7.2.0 < 7.2.0.21org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth >= 7.0.385 < 7.0.385.17Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5387/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-0326NoneImproper Token Revocation in WSO2 Identity Server Allows Unauthorized Access
CVE-2024-8122Medium· 5.9The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA)
CVE-2026-3583Low· 3.1Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
CVE-2024-5563Medium· 4.8Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks
CVE-2025-13591Medium· 5.3Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery
CVE-2025-13173Medium· 6.5Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination